search

krmaxwell / maltrieve

A tool to retrieve malware directly from the source for security researchers.
GNU General Public License v3.0
562 stars 184 forks source link

Proxy Support #80

Closed dray0n closed 9 years ago

dray0n commented 9 years ago

I have setup Tor + Privoxy on a host on my network. I have validated that it is properly working:

curl -x http://icanhazip.com Response:

curl -x proxy:port http://icanhazip.com Response: New IP

The normal IP Lookup in Maltrieve when is through 'whatthehellismyip.com' which has been down for me. I have switched it to 'icanhazip.com' and now get responses. The problem I am having is when running Maltrieve with a proxy input, it is still registering my home IP in the log.

If the IP lookup properly going through the proxy or is proxy support not working?

Thanks!

dray0n commented 9 years ago

userr@box:~/scripts/maltrieve$ curl -x http://127.0.0.1:8118 icanhazip.com 46.182.106.190

user@box:~/scripts/maltrieve$ ./maltrieve.py -p 127.0.0.1:8118 -d ~/malware

Log: 2015-02-04 20:13:28 140520711960384 Using proxy {'http': '127.0.0.1:8118'} 2015-02-04 20:13:28 140520711960384 Starting new HTTP connection (1): icanhazip.com 2015-02-04 20:13:29 140520711960384 "GET /?ipraw HTTP/1.1" 200 13 2015-02-04 20:13:29 140520711960384 External sites see <Home IP> `\

krmaxwell commented 9 years ago

I will investigate this. And a PR to replace whatthehellismyip.com would be welcome too :)

dray0n commented 9 years ago

Thank you. It might be nice to echo the IP information to the console as well. In the event someone doesn't view the log...

That feature may even be nice for as a standard echo to console. I have changed the vm that this runs on to route all traffic through Tor now. Always nice to feel a bit safer. :)

dray0n commented 9 years ago

Ran the proxy-fix branch -- IP echo in shell reflects a Tor-routed IP address. Problem solved!